Essential Eight mitigation strategy for multi-factor authentication of staff and customers to online services, then to systems and data repositories, moving to phishing-resistant methods at higher maturity levels.
Multi-factor authentication at Maturity Level One: MFA for staff on the organisation's and third-party online services holding sensitive data, for customer services holding sensitive customer data, and a required combination of factors.
Multi-factor authentication at Maturity Level Two: MFA extends to privileged and unprivileged users of systems, must be phishing-resistant for staff, must offer customers a phishing-resistant option, and MFA events are centrally logged.
Multi-factor authentication at Maturity Level Three: phishing-resistant MFA for users of data repositories, and phishing-resistant MFA required (not just offered) for customers of online customer services.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.